File: //opt/BCLinux/bse/include/TextInfos.xml
<?xml version="1.0" encoding="utf-8"?>
<Language_ZH_Hant/>
<Data>
<Row Tag="TXT_WRN_C01" Text="No /etc/motd set"/>
<Row Tag="TXT_WRN_C02" Text="No password remember times"/>
<Row Tag="TXT_WRN_C03_01" Text="Wrong password minLen set"/>
<Row Tag="TXT_WRN_C03_02" Text="No password minLen set"/>
<Row Tag="TXT_WRN_C03_03" Text="Wrong Password ucredit set"/>
<Row Tag="TXT_WRN_C03_04" Text="No password ucredit set"/>
<Row Tag="TXT_WRN_C03_05" Text="Wrong password lcredit set"/>
<Row Tag="TXT_WRN_C03_06" Text="No password lcredit set"/>
<Row Tag="TXT_WRN_C03_07" Text="wrong Password dcredit set"/>
<Row Tag="TXT_WRN_C03_08" Text="No Password dcredit set"/>
<Row Tag="TXT_WRN_C03_09" Text="wrong Password ocredit set"/>
<Row Tag="TXT_WRN_C03_10" Text="No Password ocredit set"/>
<Row Tag="TXT_WRN_C04_01" Text="wrong user login lock Deny set"/>
<Row Tag="TXT_WRN_C04_02" Text="No user login lock Deny set"/>
<Row Tag="TXT_WRN_C05" Text="You should disable ICMP redirect"/>
<Row Tag="TXT_WRN_C06 " Text="Umask value is not 027, need change for secure"/>
<Row Tag="TXT_WRN_C07_01" Text="No TMOUT set, and this not safe"/>
<Row Tag="TXT_WRN_C07_02" Text="Wrong TMOUT set, and this not safe"/>
<Row Tag="TXT_WRN_C08_1" Text="file /etc/passwd's property is not safe"/>
<Row Tag="TXT_WRN_C08_2" Text="file /etc/gruop's property is not safe"/>
<Row Tag="TXT_WRN_C08_3" Text="file /etc/grub2.conf's property is not safe"/>
<Row Tag="TXT_WRN_C08_4" Text="file /boot/grub2/grub.cfg's property is not safe"/>
<Row Tag="TXT_WRN_C08_5" Text="file /etc/lilo.conf's property is not safe"/>
<Row Tag="TXT_WRN_C08_6" Text="file /etc/shadow's property is not safe"/>
<Row Tag="TXT_WRN_C08_7" Text="dir /etc/security's property is not safe"/>
<Row Tag="TXT_WRN_C08_8" Text="dir /etc/rc.d/init.d's property is not safe"/>
<Row Tag="TXT_WRN_C08_9" Text="dir /etc/rc0.d's property is not safe"/>
<Row Tag="TXT_WRN_C08_10" Text="dir /etc/rc1.d's property is not safe"/>
<Row Tag="TXT_WRN_C08_11" Text="dir /etc/rc2.d's property is not safe"/>
<Row Tag="TXT_WRN_C08_12" Text="dir /etc/rc3.d's property is not safe"/>
<Row Tag="TXT_WRN_C08_13" Text="dir /etc/rc4.d's property is not safe"/>
<Row Tag="TXT_WRN_C08_14" Text="dir /etc/rc5.d's property is not safe"/>
<Row Tag="TXT_WRN_C08_15" Text="dir /etc/rc6.d's property is not safe"/>
<Row Tag="TXT_WRN_C08_16" Text="dir /tmp's property is not safe"/>
<Row Tag="TXT_WRN_C09_01" Text="PASS_MAX_DAYS value is not safe"/>
<Row Tag="TXT_WRN_C09_02" Text="PASS_MAX_DAYS value is invalid"/>
<Row Tag="TXT_WRN_C09_03" Text="PASS_MIN_DAYS value is unset"/>
<Row Tag="TXT_WRN_C09_04" Text="PASS_MIN_DAYS value is not safe"/>
<Row Tag="TXT_WRN_C09_05" Text="PASS_MIN_DAYS value is invalid"/>
<Row Tag="TXT_WRN_C09_06" Text="PASS_MIN_LEN value is unset"/>
<Row Tag="TXT_WRN_C09_07" Text="PASS_MIN_LEN value is unset"/
<Row Tag="TXT_WRN_C09_08" Text="PASS_MIN_LEN value is not safe"/>
<Row Tag="TXT_WRN_C09_09" Text="PASS_MIN_LEN value is invalid"/>
<Row Tag="TXT_WRN_C09_10" Text="PASS_WARN_AGE value is unset"/>
<Row Tag="TXT_WRN_C09_11" Text="PASS_WARN_AGE value is unset"/>
<Row Tag="TXT_WRN_C09_12" Text="PASS_WARN_AGE value is not safe"/>
<Row Tag="TXT_WRN_C09_13" Text="PASS_WARN_AGE value is invalid"/>
<Row Tag="TXT_WRN_C10_01" Text="No sshbanner config set, need add"/>
<Row Tag="TXT_WRN_C10_02" Text="The sshbanner is not set, please check the /etc/sshbanner and /etc/ssh/sshd_config">
<Row Tag="TXT_WRN_C11" Text="No ssh cipher config set, need add"/>
<Row Tag="TXT_WRN_C12_01" Text="Wrong ssh gssapi setting, need change"/>
<Row Tag="TXT_WRN_C12_02" Text="No ssh gssapi config set, need add"/>
<Row Tag="TXT_WRN_C13_01" Text="No ssh protocol set, need add"/>
<Row Tag="TXT_WRN_C13_02" Text="Wrong ssh protocol set, need change"/>
<Row Tag="TXT_WRN_C14_01" Text="No ssh Root Deny setting, need add"/>
<Row Tag="TXT_WRN_C14_02" Text="Wrong ssh Root Deny setting"/>
<Row Tag="TXT_WRN_C15_01" Text="Has unused software need to be disabled "/>
<Row Tag="TXT_WRN_C15_02" Text="Unsupport system"/>
<Row Tag="TXT_WRN_C16" Text="Has unused user need to be disabled"/>
<Row Tag="TXT_WRN_C17" Text="The security audit model authpriv.info is not set"/>
<Row Tag="TXT_WRN_C18" Text="The security audit model kern.warn is not set"/>
<Row Tag="TXT_WRN_C19" Text="The security audit model *err is not set"/>
<Row Tag="TXT_WRN_C20" Text="The security audit model auth.none is not set"/>
<Row Tag="TXT_WRN_C21" Text="The system remain issue file"/>
<Row Tag="TXT_WRN_C22_01" Text="The system soft core limit is not '0'"/>
<Row Tag="TXT_WRN_C22_02" Text="The system has no soft core limit set"/>
<Row Tag="TXT_WRN_C22_03" Text="The system hard core limit is not '0'"/>
<Row Tag="TXT_WRN_C22_04" Text="The system has no hard core limit set"/>
<Row Tag="TXT_WRN_C23_01" Text="The vsftpd's anonymous_enable is not 'NO'"/>
<Row Tag="TXT_WRN_C23_02" Text="The vsftpd's ftp_banner is not set"/>
<Row Tag="TXT_WRN_C23_03" Text="The vsftpd's userlist_enable=YES is not YES"/>
<Row Tag="TXT_WRN_C23_04" Text="The vsftpd's ftpusers config file doesn't contains user:root"/>
<Row Tag="TXT_WRN_C24" Text="There is no pam_wheel set"/>
<Row Tag="TXT_WRN_C25" Text="There is no customer user"/>
<Row Tag="TXT_WRN_C26_01" Text="No ssh syslogfacility set, need add"/>
<Row Tag="TXT_WRN_C26_02" Text="Wrong ssh syslogfacility set, need change"/>
<Row Tag="TXT_WRN_C27" Text=""/>
<Row Tag="TXT_WRN_C28" Text=""/>
<Row Tag="TXT_WRN_C29_01" Text="Has software need to be updated"/>
<Row Tag="TXT_WRN_C29_02" Text="Can't do yum check-update, network unreacheable"/>
<Row Tag="TXT_WRN_C40" Text="One or more log file's property is not 600"/>
<Row Tag="TXT_ROOTKIT_C41" Text="the system maybe infected"/>
<Row Tag="TXT_WRN_C50_01" Text="No ALWAYS_SET_PATH set, need add"/>
<Row Tag="TXT_WRN_C50_02" Text="Wrong ALWAYS_SET_PATH set, need change"/>
<Row Tag="TXT_WRN_C51_01" Text="No ssh loglevel set, need add"/>
<Row Tag="TXT_WRN_C51_02" Text="Wrong ssh loglevel set, need change"/>
</Data>
<Data>
<Row Tag="TXT_SUG_C01" Text="1、修改文件/etc/motd的内容，如没有该文件，则创建它。</br> #echo 'Authorized users only. All activity may be monitored and reported ' > /etc/motd。</br>2、可根据实际需要修改该文件的内容。</br>补充操作说明：/etc/motd文件不为空"/>
<Row Tag="TXT_SUG_C02" Text="1、执行备份：</br>#cp -p /etc/pam.d/system-auth /etc/pam.d/system-auth_bak </br> 2、创建文件/etc/security/opasswd，并设置权限：</br>#touch /etc/security/opasswd </br>#chown root:root /etc/security/opasswd </br>#chmod 600 /etc/security/opasswd </br>3、修改策略设置：</br>#vi /etc/pam.d/system-auth </br>#在password的pam_unix.so模块所在行增加remember=5，保存退出。 </br>类似如下：password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=5 </br>或：password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow remember=5 </br>补充操作说明：/etc/pam.d/system-auth文件中存在passwordxxxremember=值大于等于5"/>
<Row Tag="TXT_SUG_C03_01" Text="1、执行备份：</br>#cp -p /etc/pam.d/system-auth /etc/pam.d/system-auth_bak </br>或者</br>cp -p /etc/pam.d/passwd /etc/pam.d/passwd_bak </br>2、修改策略设置：</br>#vi /etc/pam.d/system-authpassword requisite pam_cracklib.so minlen=8 </br>password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok </br>注：suse设备是/etc/pam.d/passwd文件"/>
<Row Tag="TXT_SUG_C03_02" Text="1、执行备份：</br>#cp -p /etc/pam.d/system-auth /etc/pam.d/system-auth_bak </br>或者</br>cp -p /etc/pam.d/passwd /etc/pam.d/passwd_bak </br>2、修改策略设置：</br>#vi /etc/pam.d/system-authpassword requisite pam_cracklib.so ucredit=-1 </br>password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok </br>注：suse设备是/etc/pam.d/passwd文件"/>
<Row Tag="TXT_SUG_C03_03" Text="1、执行备份：</br>#cp -p /etc/pam.d/system-auth /etc/pam.d/system-auth_bak </br>或者</br>cp -p /etc/pam.d/passwd /etc/pam.d/passwd_bak </br>2、修改策略设置：</br>#vi /etc/pam.d/system-authpassword requisite pam_cracklib.so lcredit=-1 </br>password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok </br>注：suse设备是/etc/pam.d/passwd文件"/>
<Row Tag="TXT_SUG_C03_04" Text="1、执行备份：#cp -p /etc/pam.d/system-auth /etc/pam.d/system-auth_bak </br>或者</br> cp -p /etc/pam.d/passwd /etc/pam.d/passwd_bak </br>2、修改策略设置：</br>#vi /etc/pam.d/system-auth </br>password requisite pam_cracklib.so dcredit=-1 </br>password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok </br>注：suse设备是/etc/pam.d/passwd文件"/>
<Row Tag="TXT_SUG_C03_05" Text="1、执行备份：</br>#cp -p /etc/pam.d/system-auth /etc/pam.d/system-auth_bak </br>或者</br>cp -p /etc/pam.d/passwd /etc/pam.d/passwd_bak </br>2、修改策略设置：</br>#vi /etc/pam.d/system-authpassword requisite pam_cracklib.so ocredit=-1 </br>password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok </br>注：suse设备是/etc/pam.d/passwd文件"/>
<Row Tag="TXT_SUG_C04" Text="1、执行备份：</br>#cp -p /etc/pam.d/system-auth /etc/pam.d/system-auth_bak </br>2、修改策略设置：</br>#vi /etc/pam.d/system-auth</br>增加auth required pam_tally2.so deny=5 onerr=fail unlock_time=120到第二行，保存退出；</br>补充操作说明：使配置生效需重启服务器。</br>root帐户不在锁定范围内。</br>帐户被锁定后，可使用faillog -u <username> -r或pam_tally2 --user <username> --reset解锁。</br>/etc/pam.d/system-auth文件中存在deny的值小于等于5"/>
<Row Tag="TXT_SUG_C05" Text="1、备份文件：</br>#cp -p /etc/sysctl.conf /etc/sysctl.conf_bak </br>2、执行：#vi /etc/sysctl.conf，加上net.ipv4.conf.all.accept_redirects=0 </br>也可以用以下命令修改net.ipv4.conf.all.accept_redirects的值为0 </br>sysctl -w net.ipv4.conf.all.accept_redirects=03.</br>使得配置生效：sysctl -p </br>补充操作说明：可能导致路由错误，无法通信。</br>/etc/sysctl.conf文件配置了net.ipv4.conf.all.accept_redirects等于0"/>
<Row Tag="TXT_SUG_C06" Text="1、执行备份：</br>#cp -p /etc/profile /etc/profile_bak </br>#cp -p /etc/csh.login /etc/csh.login_bak </br>#cp -p /etc/csh.cshrc /etc/csh.cshrc_bak </br>#cp -p /etc/bashrc /etc/bashrc_bak </br>#cp -p /root/.bashrc /root/.bashrc_bak </br>#cp -p /root/.cshrc /root/.cshrc_bak </br>2、修改umask设置：</br>#vi /etc/profile </br>#vi /etc/csh.login </br>#vi /etc/csh.cshrc </br>#vi /etc/bashrc </br>#vi /root/.bashrc </br>#vi /root/.cshrc </br>将umask值修改为027，保存退出。</br>补充操作说明：umask设置不当可能导致某些应用无法正确自动创建目录或文件，从而运行异常。</br>/etc/profile文件中umask值大于等于027"/>
<Row Tag="TXT_SUG_C07" Text="1、执行备份：</br>#cp -p /etc/profile /etc/profile_bak </br>#cp -p /etc/csh.cshrc /etc/csh.cshrc_bak </br>2、在/etc/profile文件增加以下两行：</br>#vi /etc/profile </br>TMOUT=180 </br>export TMOUT </br>3、修改/etc/csh.cshrc文件，添加如下行：</br>set autologout=30 </br>改变这项设置后，重新登录才能有效。 </br>补充操作说明：/etc/profile 文件中TMOUT值小于等于600 </br>或者/etc/csh.cshrc文件中autologout小于等于600"/>
<Row Tag="TXT_SUG_C08_1" Text="1、修改文件权限：</br>#chmod 0644 /etc/passwd </br>补充操作说明/etc/passwd权限为644"/>
<Row Tag="TXT_SUG_C08_2" Text="1、修改文件权限：</br>#chmod 644 /etc/group </br>补充操作说明/etc/group权限为644"/>
<Row Tag="TXT_SUG_C08_3" Text="1、修改文件权限：</br>#chmod 600 /etc/grub2.conf。</br> 补充操作说明/etc/grub2.conf权限为600"/>
<Row Tag="TXT_SUG_C08_4" Text="1、修改文件权限：</br>#chmod 600 /boot/grub2/grub.cfg。</br> 补充操作说明/boot/grub2/grub.cfg权限为600"/>
<Row Tag="TXT_SUG_C08_5" Text="1、修改文件权限：</br>#chmod 600 /etc/lilo.conf。</br> 补充操作说明/etc/lilo.conf权限为600"/>
<Row Tag="TXT_SUG_C08_6" Text="1、修改文件权限：</br>#chmod 400 /etc/shadow。</br> 补充操作说明/etc/shadow/权限为400"/>
<Row Tag="TXT_SUG_C08_7" Text="1、修改文件权限：</br>#chmod 751 /etc/security。</br> 补充操作说明/etc/security/权限为751"/>
<Row Tag="TXT_SUG_C08_8" Text="1、修改文件权限：</br>#chmod 750 /etc/rc.d/init.d/。</br> 补充操作说明/etc/rc.d/init.d/权限为750"/>
<Row Tag="TXT_SUG_C08_9" Text="1、修改文件权限：</br>#chmod 750 /etc/rc0.d/。</br> 补充操作说明/etc/rc0.d/权限为750"/>
<Row Tag="TXT_SUG_C08_10" Text="1、修改文件权限：</br>#chmod 750 /etc/rc1.d/。</br> 补充操作说明/etc/rc1.d/权限为750"/>
<Row Tag="TXT_SUG_C08_11" Text="1、修改文件权限：</br>#chmod 750 /etc/rc2.d/。</br> 补充操作说明/etc/rc2.d/权限为750"/>
<Row Tag="TXT_SUG_C08_12" Text="1、修改文件权限：</br>#chmod 750 /etc/rc3.d/。</br> 补充操作说明/etc/rc3.d/权限为750"/>
<Row Tag="TXT_SUG_C08_13" Text="1、修改文件权限：</br>#chmod 750 /etc/rc4.d/。</br> 补充操作说明/etc/rc4.d/权限为750"/>
<Row Tag="TXT_SUG_C08_14" Text="1、修改文件权限：</br>#chmod 750 /etc/rc5.d/。</br> 补充操作说明/etc/rc5.d/权限为750"/>
<Row Tag="TXT_SUG_C08_15" Text="1、修改文件权限：</br>#chmod 750 /etc/rc6.d/。</br> 补充操作说明/etc/rc6.d/权限为750"/>
<Row Tag="TXT_SUG_C08_16" Text="1、修改文件权限：</br>#chmod 750 /tmp。</br> 补充操作说明/tmp权限为750"/>
<Row Tag="TXT_SUG_C09_01" Text="1、执行备份：</br>#cp -p /etc/login.defs /etc/login.defs_bak </br>2、修改策略设置：</br>#vi /etc/login.defs </br>修改PASS_MAX_DAYS的值为90，保存退出。</br>补充操作说明：/etc/login.defs文件中PASS_MAX_DAYS值不大于90"/>
<Row Tag="TXT_SUG_C09_02" Text="1、执行备份：</br>#cp -p /etc/login.defs /etc/login.defs_bak </br>2、修改策略设置：</br>#vi /etc/login.defs </br>修改PASS_MAX_DAYS的值为90，保存退出。</br>补充操作说明：/etc/login.defs文件中PASS_MAX_DAYS值不大于90"/>
<Row Tag="TXT_SUG_C09_03" Text="1、执行备份：</br>#cp -p /etc/login.defs /etc/login.defs_bak </br>2、配置ASS_MIN_DAYS 6"/>
<Row Tag="TXT_SUG_C09_04" Text="1、执行备份：</br>#cp -p /etc/login.defs /etc/login.defs_bak </br>2、修改策略设置：</br>#vi /etc/login.defs </br>修改PASS_MIN_DAYS的值为6，保存退出。</br>补充操作说明：/etc/login.defs文件中PASS_MIN_DAYS值不小于6"/>
<Row Tag="TXT_SUG_C09_05" Text="请确保PASS_MIN_DAYS关键字拼写格式正确。"/>
<Row Tag="TXT_SUG_C09_06" Text="1、执行备份：</br>#cp -p /etc/login.defs /etc/login.defs_bak </br>2、配置PASS_MIN_LEN 8"/>
<Row Tag="TXT_SUG_C09_07" Text="1、执行备份：</br>#cp -p /etc/login.defs /etc/login.defs_bak </br>2、修改策略设置：</br>#vi /etc/login.defs </br>修改PASS_MIN_LEN的值为8，保存退出。</br>补充操作说明：/etc/login.defs文件中PASS_MIN_LEN值不小于8"/>
<Row Tag="TXT_SUG_C09_08" Text="1、执行备份：</br>#cp -p /etc/login.defs /etc/login.defs_bak </br>2、修改策略设置：</br>#vi /etc/login.defs </br>修改PASS_MIN_LEN的值为8，保存退出。</br>补充操作说明：/etc/login.defs文件中PASS_MIN_LEN值不小于8"/>
<Row Tag="TXT_SUG_C09_09" Text="请确保PASS_MIN_LEN关键字拼写正确。"/>
<Row Tag="TXT_SUG_C09_10" Text="1、执行备份：</br>#cp -p /etc/login.defs /etc/login.defs_bak </br>2、配置ASS_WARN_AGE 30"/>
<Row Tag="TXT_SUG_C09_11" Text="1、执行备份：</br>#cp -p /etc/login.defs /etc/login.defs_bak </br>2、修改策略设置：</br>#vi /etc/login.defs </br>修改PASS_WARN_AGE的值为30，保存退出。</br>补充操作说明：/etc/login.defs文件中PASS_WARN_AGE值不小于30"/>
<Row Tag="TXT_SUG_C09_12" Text="1、执行备份：</br>#cp -p /etc/login.defs /etc/login.defs_bak </br>2、修改策略设置：</br>#vi /etc/login.defs </br>修改PASS_WARN_AGE的值为30，保存退出。</br>补充操作说明：/etc/login.defs文件中PASS_WARN_AGE值不小于30"/>
<Row Tag="TXT_SUG_C09_13" Text="请确保PASS_WARN_AGE关键字拼写格式正确。"/>
<Row Tag="TXT_SUG_C10" Text="1、执行备份：</br>#cp -p /etc/ssh/sshd_config /etc/ssh/sshd_config_bak </br>2、在/etc/sshbanner文件中填入ssh登录的banner信息。</br>3、配置/etc/ssh/sshd_config中的banner选项：</br> Banner /etc/sshbanner。</br>4、重启sshd服务。"/>
<Row Tag="TXT_SUG_C11" Text="1、执行备份：</br>#cp -p /etc/ssh/sshd_config /etc/ssh/sshd_config_bak </br>2、在/etc/ssh/sshd_config中添加cipher配置: </br> Ciphers aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc </br>MACs hmac-sha1。</br>3、重启sshd服务。"/>
<Row Tag="TXT_SUG_C12" Text="1、执行备份：</br>#cp -p /etc/ssh/sshd_config /etc/ssh/sshd_config_bak </br>2、在/etc/ssh/sshd_config中添加 GSSAPIAuthentication no。</br>3、重启sshd服务。"/>
<Row Tag="TXT_SUG_C13" Text="1、执行备份：</br>#cp -p /etc/ssh/sshd_config /etc/ssh/sshd_config_bak </br>2、在/etc/ssh/sshd_config中添加 Protocol 2。</br>3、重启sshd服务。"/>
<Row Tag="TXT_SUG_C14" Text="1、执行备份：</br>#cp -p /etc/securetty /etc/securetty_bak </br>#cp -p /etc/ssh/sshd_config /etc/ssh/sshd_config_bak </br>2、禁止root用户远程登录系统：</br>#vi /etc/securetty </br>注释形如pts/x的行，保存退出，则禁止了root从telnet登录。</br>#vi /etc/ssh/sshd_config </br>修改PermitRootLogin设置为no并不被注释，保存退出，则禁止了root从ssh登录。3、重启sshd服务 </br>#/etc/init.d/sshd restart"/>
<Row Tag="TXT_SUG_C15" Text="1、停止相关的服务：</br>service <service> stop"/>
<Row Tag="TXT_SUG_C16" Text="1、执行备份：</br>#cp -p /etc/passwd /etc/passwd_bak </br>#cp -p /etc/shadow /etc/shadow_bak </br>2、锁定无用帐户：</br>方法一：</br>#vi /etc/shadow 在需要锁定的用户名的密码字段前面加!!，如：test:!!$1$QD1ju03H$LbV4vdBbpw.MY0hZ2D/Im1:14805:0:99999:7::: </br>方法二：</br>#passwd -l test </br>3、将/etc/passwd文件中的shell域设置成/bin/false。</br>补充操作说明：lp uucp nobody games rpm smmsp nfsnobody这些帐户不存在或者它们的密码字段为!! </br>注意：在/etc/shadow文件中若账号的密码段为*号，同时需要在/etc/passwd文件中该账号的shell域（即第6个“：”后面）设置/bin/false才合规。"/>
<Row Tag="TXT_SUG_C17" Text="1、执行备份：</br>#cp -p /etc/syslog.conf /etc/syslog.conf_bak </br>2、修改配置：</br>#vi /etc/syslog.conf </br>配置形如：authpriv.* /var/log/authlog的语句，保存退出 </br>3、重启syslog服务#/etc/init.d/syslog stop </br>#/etc/init.d/syslog start </br>补充操作说明：auth或者authpriv后面的值不是none"/>
<Row Tag="TXT_SUG_C18" Text="1、执行备份：</br>#cp -p /etc/syslog.conf /etc/syslog.conf_bak </br>2、修改配置：</br>#vi /etc/syslog.conf </br>配置形如：kern.warn /var/log/kern.log的语句，保存退出 </br>3、重启syslog服务。"/>
<Row Tag="TXT_SUG_C19" Text="1、执行备份：</br>#cp -p /etc/syslog.conf /etc/syslog.conf_bak </br>2、修改配置：</br>#vi /etc/syslog.conf </br>配置形如：*.err /var/log/error.log的语句，保存退出 </br>3、重启syslog服务。"/>
<Row Tag="TXT_SUG_C20" Text="1、执行备份：</br>#cp -p /etc/syslog.conf /etc/syslog.conf_bak </br>2、修改配置：</br>#vi /etc/syslog.conf </br>配置形如：auth.none /var/log/auth.log的语句，保存退出 </br>3、重启syslog服务。"/>
<Row Tag="TXT_SUG_C21" Text="1、执行备份：</br>#cp -p /etc/issue /etc/issue_bak。</br>2、删除/etc/issue。"/>
<Row Tag="TXT_SUG_C22_01" Text="1、执行备份：</br>#/etc/security/limits.conf /etc/security/limits.conf_bak </br>2、修改配置： 将"* soft core 0" 写入/etc/security/limits.conf。 "/>
<Row Tag="TXT_SUG_C22_02" Text="1、执行备份：</br>#/etc/security/limits.conf /etc/security/limits.conf_bak </br>2、修改配置： 将"* hard core 0" 写入/etc/security/limits.conf。"/>
<Row Tag="TXT_SUG_C23_01" Text="1、执行备份：</br>#cp -p /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf_bak。</br>2、修改配置：</br> 禁止匿名用户登录：anonymous_enable=NO </br>3、重启vsftpd服务"/>
<Row Tag="TXT_SUG_C23_02" Text="1、执行备份：</br>#cp -p /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf_bak。</br>2、修改配置：</br>#vi /etc/vsftpd.confftpd_banner=” Authorized users only. All activity may be monitored and reportedd.</br>可以根据实际需要修改该文件内容。</br>3、重启服务：# /etc/init.d/xinetd restart </br>4、补充操作说明：/etc/vsftpd/vsftpd.conf文件中存在ftpd_banner"/>
<Row Tag="TXT_SUG_C23_03" Text="1、执行备份：</br>#cp -p /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf_bak。</br>2、修改配置：</br>配置vsftpd.conf文件，设定只允许特定用户通过ftp登录：vsftpd.conf文件路径一般为/etc/vsftpd.conf或者/etc/vsftpd/vsftpd.conf。修改其中内容：userlist_enable=YES此选项被激活后，VSFTPD将读取userlist_file参数所指定的文件中的用户列表。</br>3、重启服务：# /etc/init.d/xinetd restart "/>
<Row Tag="TXT_SUG_C23_04" Text="1、修改ftpusers文件，增加不能通过ftp登录的用户。</br>2、首先需确定ftpusers文件位置，可以通过以下命令知道：#cat /etc/pam.d/vsftpd </br>auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd.ftpusers onerr=succeed </br>其中file=/etc/vsftpd.ftpusers即为当前系统上的ftpusers文件。</br>3、修改文件（假设文件为/etc/ftpusers）：# vi /etc/ftpusers </br>在文件中增加以下用户，则该用户均不允许通过ftp登录：</br>root daemon bin sys adm lp uucp nuucp listen nobody noaccess nobody4"/>
<Row Tag="TXT_SUG_C24" Text="修改/etc/pam.d/su文件，添加如下行：</br>auth required pam_wheel.so use_uid"/>
<Row Tag="TXT_SUG_C25" Text="如果没有需要，则删除多余的用户。"/>
<Row Tag="TXT_SUG_C26" Text="1、执行备份：</br>#cp -p /etc/ssh/sshd_config /etc/ssh/sshd_config_bak </br>2、在/etc/ssh/sshd_config中将SyslogFacility AUTH取消注释</br>3、重启sshd服务。"/>
<Row Tag="TXT_SUG_C27" Text="1、执行备份：</br>#cp -np /etc/aliases 或 cp -np /etc/mail/aliases。</br>2、删除或注释无用别名：games ingres system toor uucp manager dumper operator decode marc</br>补充操作说明：更新后运行/usr/bin/newaliases,使改变生效 </br>"/>
<Row Tag="TXT_SUG_C28" Text=""/>
<Row Tag="TXT_SUG_C29_01" Text="确保考虑到业务的稳定性的前提下，使用 'yum check-update' 来查看系统软件的升级情况，在确认业务不受影响的情况下，可以使用yum update "pkg-name" 来升级相关软件。"/>
<Row Tag="TXT_SUG_C29_02" Text="请确保当前系统的网络连接正常，可以访问mirrors.bclinux.org"/>
<Row Tag="TXT_SUG_C30" Text="确保考虑到业务的稳定性的前提下，使用 'yum update "pkg-name"' 来升级相关的软件，修复软件包存在的相关CVE漏洞。"/>
<Row Tag="TXT_SUG_C40" Text="请确保/var/log/下的敏感日志文件的权限为600"/>
<Row Tag="TXT_SUG_C41" Text="请重新检查问题文件，或删除病毒文件，或重装系统"/>
<Row Tag="TXT_SUG_C50" Text="1、执行备份：</br>#cp -np /etc/login.defs /etc/login.defs_bak </br>2、修改策略设置：</br>#vi /etc/login.defs </br>增加ALWAYS_SET_PATH=yes，保存退出。"/>
<Row Tag="TXT_SUG_C51" Text="1、执行备份：</br>#cp -np /etc/ssh/sshd_config /etc/ssh/sshd_config_bak </br>2、在/etc/ssh/sshd_config中将LogLevel修改为VERBOSE</br>3、重启sshd服
务。"/>
</Data>